CVE-2026-103884: Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read
A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the X.509 client certificate authenticator with CRL Distribution Point checking enabled are exposed. The provided information does not establish that configurations without this checking enabled are affected.
What does an attacker need to exploit it?
An attacker needs to provide a specially crafted client certificate. The certificate can contain a malicious CRL Distribution Point path that causes the server to read local files or load extremely large files.
What is the likely impact if exploitation succeeds?
The server may attempt to read sensitive files from its local system, creating a risk of information disclosure. Loading an extremely large file may exhaust memory and crash the server.